5cdd98cc1234ae662a94560c4525595e5adb7304d6e80b059c00829b917bc28e

Analysis

max time kernel
25s
max time network
25s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:05

Target

03ff403b663adde9455683848c95b626.exe
Size

180KB
MD5

03ff403b663adde9455683848c95b626
SHA1

f3339a1c01a71adae09d5bcee23aabe36927a6c1
SHA256

5cdd98cc1234ae662a94560c4525595e5adb7304d6e80b059c00829b917bc28e
SHA512

93b266c3aec00ed61c0514c17465e69e3777b63f9c846a4848a55a7b5768af19b497826d0f3bf07fdb59270603858652dfbb8372a4c4d5caba02732c2dfefb26
SSDEEP

3072:sAM8Wkp6TTgCDMFyekm7hvmpj+SMUAYn8JGjV8eymaUGC+L0gFFnawxGCX2TtUFr:sAmTTg3Q1ehvmgSMUAYny4TXACRgFFay

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	2524	WerFault.exe	11

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2104	2524	03ff403b663adde9455683848c95b626.exe	28
PID 2524 wrote to memory of 2104	2524	03ff403b663adde9455683848c95b626.exe	28
PID 2524 wrote to memory of 2104	2524	03ff403b663adde9455683848c95b626.exe	28
PID 2524 wrote to memory of 2104	2524	03ff403b663adde9455683848c95b626.exe	28

C:\Users\Admin\AppData\Local\Temp\03ff403b663adde9455683848c95b626.exe
"C:\Users\Admin\AppData\Local\Temp\03ff403b663adde9455683848c95b626.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 116
  2⤵
  - Program crash
  PID:2104

memory/2524-0-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2524-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2524-2-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2524-3-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download